Isn't that an orthogonal concern? There's nothing technical to prevent Firefox Send from using a native client instead of a web page. The client could have the

Isn't that an orthogonal concern? There's nothing technical to prevent Firefox Send from using a native client instead of a web page. The client could have the same trust model as everything else on your system, while still embedding the key into the final URL or link you share with other users. It wouldn't even need to be complicated -- a wrapper around libsodium that pushed encrypted data to a couple of REST endpoints would do the job.